anonhaven

CVE-2026-67367

CRITICAL CVSS 4.0: 9.2 EPSS 1.11%
Updated Sep 09, 2026
Siemens
Parameter Value
CVSS 9.2 (CRITICAL)
Type CWE-23 (Relative Path Traversal)
Vendor Siemens
Public PoC No

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-23 Relative Path Traversal

Vulnerable Products

siemens:siplant v1.7 siemens:siplant v3.1 siemens:simove fleetmanager v3.1 siemens:simove fleetmanager v4.0 siemens:siplant v2.2 siemens:simove fleetmanager v3.3 siemens:siplant v3.0 siemens:simove fleetmanager v3.2

References 1

https://cert-portal.siemens.com/productcert/html/ssa-517424.html
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-89205

Siemens

5.3

CVE-2026-89200

Siemens

8.4

CVE-2026-63352

Siemens

5.3

CVE-2026-44414

Siemens

6.9

CVE-2026-89207

Siemens

6.9